# What is a dictionary attack?

> An attack that tries words, names, and known passwords with common variations instead of every combination.

Last reviewed: 2026-09-01

## Dictionary attack

Category: Attacks

Canonical page: https://moolkey.com/glossary/dictionary-attack

A dictionary attack starts with a curated list of real words, names, and previously breached passwords. It then applies rules such as capitalising the first letter, appending a year, or swapping a for 4. This is much faster than brute force because human password choices are less random than they appear.

### Why leet substitutions do not help

Every serious cracking tool applies substitution rules automatically. Turning 'password' into 'p@ssw0rd' adds under one bit of real strength, because the rule is in the toolkit's default configuration. The word is the weakness; disguising it changes almost nothing.

### The rule that follows from this

If a human chose it, assume a dictionary attack may find it. Strength should come from random selection: either random characters or random words drawn by a machine from a list you did not curate.

Further reading: [Test a password against these patterns](https://moolkey.com/tools/password-strength-checker)

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.